Dashboard accounts

Open Account → Users as an administrator to see the dashboard accounts. The page opens on a line that counts the accounts and administrators, names the last sign-in, and says how many accounts a password alone opens. Selecting that verdict narrows the list to those accounts. Chips above the cards filter by role, Password only (shown as Enrollment required when two-factor is mandatory), Never signed in, and Disabled.

Add an accountCopy Anchor Link

1. Select New user on Account → Users.
2. Enter a Name and a Username, then set a Temporary password of at least 12 characters mixing three of uppercase, lowercase, digits, and symbols.
3. Choose a Role. New accounts start as readonly; use the narrowest role that allows the person's work. The roles reference shows what each role can do.
4. Select Create user, then give the person the sign-in address and temporary password through a channel you trust. They must replace the password at first sign-in.
5. If your installation requires two-factor for every account, they enroll an authenticator during sign-in. An enrolled account is challenged even when the global requirement is off.

After the first sign-in, a new account is asked once what it will use the server for. Its answer decides which sections its sidebar shows; see Choose your sidebar.

Change or remove an accountCopy Anchor Link

Each account card shows its role, whether two-factor guards it, and when it last signed in.

• Change the role from the picker on the card. Role changes are enforced by the backend and also narrow any API keys the account created.
• Turn the card's switch off to stop the account signing in. This signs out its sessions; its API keys stop working while it is disabled. You cannot disable your own account.
• Select the card, or Edit from its menu, to rename the account, change its username, or give it a new password. Setting a password signs the person out everywhere. Earlier audit entries keep the old username.
• Choose Reset two-factor from the menu when someone has lost both their authenticator and their recovery codes.
• Choose Delete to remove the account. It loses access immediately, with every session and API key it holds. Deletion uses an ordinary confirmation, and you cannot delete your own account.

The dashboard refuses a role change, disable, or deletion that would leave it without an enabled administrator.

Manage your own accountCopy Anchor Link

Account → Profile shows your username, role, when you joined, your last sign-in, and the client and network of this session. Signed in as you draws your sessions and your own API keys; What this account can do lists the capabilities your role grants and the ones it does not. Under Profile you can change your name, your username, and your picture.

Account → Security holds your password and two-factor settings. Changing your password signs out every session, including the current one. Save recovery codes when they are shown: they are for regaining access if your authenticator is unavailable.

If the server generated your initial password and printed it to its logs, the first sign-in requires a password change after any required second factor. A password supplied through the installer, set by an administrator under Edit, or set with scripts/reset-password.sh or scripts/create-user.sh is not forced to change.

Choose your sidebarCopy Anchor Link

Open Account → Workspace to change which sections your sidebar shows. What you use this server for offers the same purposes as the first-run question: Ship apps, Run databases, Work on the server, Manage containers, Secure the server, and Route the network, which is marked experimental. The Sidebar preview has a switch for each section you may hide. Save from the bar at the foot of the window, or select Ask me again to answer the first-run question afresh.

The choice belongs to your account, so it follows you to every browser. A hidden section is still reachable: links from other pages open it, and search finds it. Hiding a section never changes what your role allows, and a section your role cannot open is not offered. Accounts created before 0.7.3 keep every section until they change it.

Recover an account from the serverCopy Anchor Link

If a password is forgotten, the sign-in page's Forgot it? gives the command to run in the dashboard's folder on the server:

sudo ./scripts/reset-password.sh USER

sudo ./scripts/create-user.sh USER [readonly|limited|admin] creates an account, and sudo ./scripts/manage.sh revoke-sessions USER signs an account out everywhere. These scripts prompt for passwords with hidden input and also work while the backend is stopped.

For sessions and API credentials, continue to Sessions and API keys.